CVE-2026-50151: oras-go blob upload vulnerable to credential forwarding via unvalidated Location header
oras-go follows a registry-controlled Location header during the monolithic blob upload flow and reuses the Authorization header from the initial POST request for the subsequent PUT request. If a malicious registry returns a cross-host Location, oras-go can send the caller’s credentials to an attacker-controlled endpoint.
References
- github.com/advisories/GHSA-jxpm-75mh-9fp7
- github.com/oras-project/oras-go/commit/4683c46ef078091544f5f55fd25102f002806991
- github.com/oras-project/oras-go/pull/1152
- github.com/oras-project/oras-go/releases/tag/v2.6.1
- github.com/oras-project/oras-go/security/advisories/GHSA-jxpm-75mh-9fp7
- nvd.nist.gov/vuln/detail/CVE-2026-50151
Code Behaviors & Features
Detect and mitigate CVE-2026-50151 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →